Over the past year, GreyNoise has moved further right on MITRE ATT&CK, helping defenders detect and investigate activity at the edge, uncover signs of compromise, and analyze the artifacts captured from their own sensors.
Today, we’re introducing a redesigned GreyNoise Visualizer that makes it easier to navigate those capabilities and brings related workflows together in one place.
Organized around how you work
The most noticeable change is the navigation.
Instead of dropdown menus across the top of the Visualizer, the new experience uses a persistent sidebar organized around three areas:
- Intelligence for investigating IPs and CVEs
- Observation for working with their own Deception Sensors and exploring the sessions, activity, and post-compromise behavior they capture
- Automation for actioning on GreyNoise intelligence via alerts, feeds, and blocklists
Dashboards sit at the top, giving you a quick way to return to the intelligence you care about most.
See the new Visualizer in action
Watch a quick walkthrough of the redesigned Visualizer, including the new navigation, search experience, and updated investigation workflows.
Search from anywhere
Search is now available throughout the Visualizer.
Open it from the sidebar, use Command + K, or start from the Visualizer home page. From the same search experience, you can look across IPs, Callback, CVEs, and Tags.
For IP investigations, we’ve also changed how GreyNoise Query Language (GNQL) queries are displayed. Individual search terms can be shown as badges, making it easier to add or remove filters, switch between AND and OR, and refine a search without rewriting the entire query.
Prefer writing GNQL directly? You can switch back to raw query text at any time.
Intelligence, investigation, and action are closer together
Several workflows that previously lived on separate pages now sit directly alongside the intelligence they relate to.
When you’re investigating scanner IPs, for example, the same query can be used to create an alert or blocklist from the Actions menu. Compare is now a view within IP search rather than a separate destination. IP and CVE bulk analysis now live together under Analysis.
The same principle carries across the Visualizer: related actions are available where you’re already working.
Triage and investigate with more context
When an IP shows up in an alert or investigation, the IP details page brings together the different ways GreyNoise may know about it.
Depending on the address, you may see intelligence from up to three GreyNoise datasets:
- Scanner for activity GreyNoise has directly observed from the IP as it scanned the internet
- Callback when the IP has appeared as a destination inside an observed exploit payload
- Business Service when the IP belongs to a known business service
When an IP appears in more than one dataset, you can move between them directly from the IP page. Scanner activity, related CVEs and tags, callback activity, and business service context are available without moving between separate parts of the Visualizer.
For analysts working through alerts or investigating suspicious infrastructure, that puts more of the context needed to understand an IP in one place.
Your sensors and what they observe, in one place
The Observation section brings together the workflows associated with GreyNoise Deception Sensors.
From here, you can deploy and manage Deception Sensors, assign profiles, inspect the individual sessions they capture, and review post-compromise activity mapped to MITRE ATT&CK tactics and techniques. Sessions are available as a list, graph, or multi-pane view, with the underlying PCAP available from the individual session.
You can also compare what your sensors observe with the broader GreyNoise sensor network. This helps teams understand what is reaching their own edge, what attackers are doing when they get there, and how that activity compares with what GreyNoise is observing across the internet.
Turn what you find into action
The Automation section brings Alerts, Feeds, and Blocklists together.
You can still manage each independently, but automation is also built directly into the investigation workflow. A useful GNQL search can become an alert that watches for new activity or a continuously updated blocklist. Alerts can also be created directly from the IP, Tag, and CVE workflows where applicable, while Feeds can stream GreyNoise events into downstream systems.
This makes it easier to move from investigating activity in GreyNoise to monitoring it or taking action in your existing tools.
Try the new Visualizer today
The new Visualizer is available today. If you’re logged in to the Classic Visualizer, click Try the New Visualizer in the upper-right corner. To switch back, click Classic from the new Visualizer header.
Your preference is saved to your GreyNoise account, so it follows you across devices.
For a complete walkthrough of the new navigation, search experience, feature locations, and what moved from the Classic Visualizer, see the New Visualizer Documentation.